This is the mail archive of the
libc-hacker@sourceware.cygnus.com
mailing list for the glibc project.
Re: [ak@muc.de] libc/796: getpass() is not usable for high security applications
On Fri, Oct 23, 1998 at 07:18:53PM +0200, Ulrich Drepper wrote:
> Andi Kleen <ak@muc.de> writes:
>
> > Ok. But could you at least remove the fflush(fh) from getpass? It
> > definitely accounts for >50% of my failed su attempts. Libc5
> > didn't flush and working with su was smoother. I think it offers
> > no security advantage.
>
> This was indeed added for security reasons. I cannot remember the
> details anymore, though.
Assuming it was added to prevent any already queued data from entering
into the su session: it would have exactly the same advantage if the
flush was done after the password read. If the attacker already knew
the password all security measures are too late. If he doesn't he will
never pass the password check, no matter what he queues first. This is
the reason why the flush is completely useless, but if you would insist
on keeping it (I hope you don't @) it would be at least less annoying
to have it after the password entry (because any missing characters are
then at least visible and can be easily corrected)
-Andi